Management of software licenses for deployed images

ABSTRACT

Systems, methods, and software described herein provide operations to manage software licenses in relation to a virtualized image. In one implementation, a system may, during a first initiation of a virtualized instance, execute a process to determine and store registration information associated with the virtualized instance. Once stored, the system may delete the process and use the stored registration information during subsequent initiations of the virtualized instance to determine whether to permit software on the virtualized instance to be executed.

BACKGROUND

Application stores are becoming more prevalent in both end user devices,such as smartphones, computers, tablets, or other similar devices, andalso in the cloud, wherein users may select an application, download theapplication, and execute the application on the end user device. Theseapplication stores are now further being adopted in cloud computingenvironments, wherein cloud computing providers may generatevirtualization images, virtual machines or containers, that can bedeployed by a user to provide various processing operations. Theseimages may be deployed in a cloud service provider server or a localserver of the end user, and may provide various operations, such asfront-end server operations, back-end server operations, data processingoperations, or some other operation.

However, while virtualization images may provide a convenient method forusers to select and deploy particular applications as virtualizedinstances, managing the licenses for the images can be difficult andcumbersome. In particular, because virtualization images may beduplicated using images and other backup software, a single download ofthe original image may be used to deploy any number of virtualizedinstances.

OVERVIEW

Provided herein are operations to manage software licenses for deployedvirtualization images. In one implementation, a method includesidentifying a request to initiate a virtualized instance and, inresponse to the request, initiating a process in the virtualizedinstance to determine registration information associated with theregistration instance. The method further provides for storing theregistration information in the virtualized instance and, once stored,deleting the process that determined the registration information.

After generating the registration information and during a subsequentinitiation of the virtualized instance, the method further includescomparing current configuration information associated with thesubsequent initiation with the registration information stored in thevirtualized instance to determine whether the subsequent initiation ispermitted. If permitted, the method initiates an application associatedwith the image.

BRIEF DESCRIPTION OF THE DRAWINGS

Many aspects of the disclosure can be better understood with referenceto the following drawings. While several implementations are describedin connection with these drawings, the disclosure is not limited to theimplementations disclosed herein. On the contrary, the intent is tocover all alternatives, modifications, and equivalents.

FIG. 1 illustrates a computing environment to deploy an image as avirtualized instance according to an implementation.

FIG. 2 illustrates an operation to deploy an image as a virtualizedinstance according to an implementation.

FIG. 3 illustrates an operational scenario to deploy an image asvirtualized instances according to an implementation.

FIG. 4 illustrates an operational scenario of managing licenses in avirtualized instance according to an implementation.

FIG. 5 illustrates an operational scenario of managing licenses in avirtualized instance according to an implementation.

FIG. 6 illustrates a computing system to manage licenses for avirtualized instance according to an implementation.

DETAILED DESCRIPTION

Examples herein provide enhancements for managing software licenses ofvirtualization images. In some implementations, one or morevirtualization images may be placed in a repository or application storethat permits users to request instances of the virtualization images.For example, an image for a virtual machine may include an operatingsystem, software, and other resources capable of providing a dataprocessing operation for a requesting user. When a user requests a newvirtualized instance or new virtual machine from the image, resourcesmay be allocated to support the request, such as processing resources,communication resources, memory resources, storage resources, and thelike, and a new instance may be initiated using the resources. In someexamples, the virtualized instance may be deployed in a cloud computingenvironment, wherein a cloud computing provider may manage the physicalcomputing resources allocated to the user. In other examples, thevirtualized instance may be deployed in a private computing environment,wherein the user may manage the physical computing resources for anyvirtualized instances associated with a user.

Here, in addition to the software the provides the requested operationsfor the end user, the image may further include a registration operationthat can used to manage the software licensing associated with the imageand the software. In some implementations, the registration operationmay, when a virtualized instance is first initiated from the requestedimage, identify registration information associated with the virtualizedinstance. The registration information may include a media accesscontrol (MAC) address associated with the instance, a virtual machineidentifier associated with the instance, a host associated with theinstance, or some other attribute associated with the deployment of theinstance. Once the registration information is determined, theregistration operation may store the registration information in thevirtualized instance.

After the registration information is stored in the instance, theregistration operation may be removed or deleted from the instance,preventing future access to the registration operation. Advantageously,when the virtualized instance is subsequently initiated, such asfollowing an update, a powered off period for the virtual machine, orpower cycle of the physical host, the software may compare currentconfiguration information for the instance with the stored registrationinformation to determine whether the initiation of the instance ispermitted. If the current configuration information and the storedregistration information match, then the software that corresponds tothe registration information may be executed. In contrast, if thecurrent configuration information fails to match stored registrationinformation, then the software that corresponds to the registrationinformation may be blocked or prevented from execution. For example, ifthe image provided a data processing application for a database, thedata processing application may only be executable when the registrationinformation matches a current configuration for the executing virtualmachine.

FIG. 1 illustrates a computing environment 100 to deploy an image as avirtualized instance according to an implementation. Computingenvironment 100 includes image source space 110 and deployment space112. Image source space includes deployment image 120 with software 122and registration operation 124. Deployment space 112 further includesvirtual machine 130 with software 122 and registration information 132with attributes 142, 152, and 162. Although demonstrated with threeattributes in the present example, it should be understood that variousattributes may be maintained as part of registration information 132.

In operation, a software provider may generate deployment image 120 thatcan be used to generate virtualized instances for various end users. Forexample, deployment image 120 may be provided to image source space 110,which may represent a repository application store where users canaccess and select desired images to provide desired functionality. Theapplication store may be part of a cloud service provider, as part of anapplication store that permits downloads to local or privately-operatedcomputing devices, or some other application repository. In someimplementations, deployment image 120 may represent an image for avirtual machine or some other similar virtualized element. A virtualmachine image is a template for creating new virtual machine instances,wherein each image may include an operating system and may furtherinclude other software, such as databases, application servers,applications, or some other process for the created image.

Here, deployment image 120 includes software 122 and registrationoperation 124. Software 122 is representative of software to providevarious operations, which may include database operations, dataprocessing operations, or some other operation. Registration operation124 is used to manage the license when deploying deployment image 120 asa virtual machine. Although not pictured, deployment image 120 mayfurther include an operating system and other processes that arerequired for the functionality of a virtual machine.

Once an image is generated and placed in image source space 110, a userwith access to image source space 110 may request a new virtualizedinstance (a new virtual machine) that is derived from the deploymentimage. After the request, a new virtual machine 130 is deployed indeployment space 112, wherein virtual machine 130 may be allocatedprocessing resources, memory resources, storage resources, or any otherrequired resource for the virtual machine. Deployment space 112 mayrepresent a cloud computing environment with one or more servingresources or may represent a private computing environment with one ormore private servers capable of executing a virtual machine from theimage. Once virtual machine 130 is initiated in deployment space 112,registration operation 124 is executed to generate registrationinformation 132. Registration information 132 may include a MAC address,virtual machine identifier associated with virtual machine 130, a hostidentifier associated with the host for virtual machine 130, or someother information or attribute associated with virtual machine 130. Onceregistration information 132 is stored in virtual machine 130,registration operation 124 is deleted or removed from virtual machine130. Registration information 132 is then used on each subsequentinitiation of virtual machine 130 to determine whether software 122 ispermitted for execution on the virtual machine. In particular, if aduplicate of virtual machine 130 is initiated to make a new virtualmachine in addition to virtual machine 130, the configurationinformation associated with the new virtual machine may not matchregistration information 132. When a failed match is detected, software122 may be prevented from being executed on the new virtual machine.

FIG. 2 illustrates an operation 200 to deploy an image as a virtualizedinstance according to an implementation. The processes of operation 200are referenced parenthetically in the paragraphs that follow withreferences to the systems and elements of computing environment 100.

As depicted, operation 200 identifies (201) a request for a firstinitiation of a virtualized instance from an image. In someimplementations, a service provider may include a repository of variousimages that can be used to deploy virtual machines, such as virtualmachine 130. In response to the request and the first initiation of thevirtualized instance, operation 200 initiates (202) a process in thevirtualized instance to determine registration information associatedwith the virtualized instance and stores (203) the registrationinformation in the virtualized instance. Referring to an example incomputing environment 100, when a request is made for deployment image120, virtual machine 130 is initiated to support the request. Onceinitiated, registration operation 124 is executed to generateregistration information 132, which includes attributes 142, 152, and162. In some examples, the attributes may be derived from the operatingsystem of the virtual machine, the hypervisor, or some other supportprocess for the virtual machine. In some examples, the registrationinformation may be stored using an encryption key that encrypts the dataprior to storage in virtual machine 130. This may permit the virtualmachine to apply an encryption function during each subsequentinitiation of the virtual machine to determine if current attributesmatch registration information 132.

After generating and storing the registration information, operation 200deletes (204) the process that determined the registration information.Advantageously, by deleting the process, end users of the virtualmachine will be unable to ascertain what registration information isused in generating the license for the software on the virtual machine.In some examples, when virtual machine 130 is initiated operation 200may further prevent communications that use one or more protocols. Theseprotocols may include SSH, or some other protocol that can permit a userto access the virtual machine prior to registering software 122. Afterstoring the registration information and deleting the correspondingregistration operation, operation 200 may the enable the one or moreprotocols to permit access to the virtual machine.

Once the registration information is stored in virtual machine 130,operation 200 further, in response to a second initiation of thevirtualized instance, compares (205) current configuration informationassociated with the subsequent initiation with the registrationinformation stored in the virtualized instance to determine whether thesubsequent initiation is permitted. For example, if virtual machine 130were shut down, migrated, or otherwise stopped, operation 200 may beused to identify current configuration information associated with thenew initiation and compare that current configuration information withthe stored registration information. The current configurationinformation may include a virtual machine identifier, a MAC address, anIP address, or some other information associated with the virtualmachine. When the current configuration information matches theregistration information, operation 200 may permit the execution of thecorresponding software 122. However, when the current configurationinformation does not match the registration information, operation 200may block the execution of the corresponding software 122. For example,if a user associated with virtual machine 130 took a snapshot of virtualmachine 130 after the storage of registration information 132, thesnapshot may be used to generate multiple duplicates of virtual machine130. However, when the duplicate is deployed, operation 200 maydetermine current configuration information associated with the newinitiation and determine that the current configuration informationfails to match the stored registration information.

In some examples, similar to the operations described above with respectto generating and storing registration information 132, operation 200may prevent ingress or egress communications associated with one or moreprotocols prior to the completion of the matching operation. Once thematching is complete and software 122 is determined to be permitted forexecution, the one or more protocols may be enabled for interaction withvirtual machine 130.

FIG. 3 illustrates an operational scenario 300 to deploy an image asvirtualized instances according to an implementation. Operationalscenario 300 includes systems and elements from computing environment100 of FIG. 1 . Operational scenario 300 further includes virtualmachine 330 that includes software 122 with registration information332, wherein registration information 332 includes attributes 342, 352,and 362.

As described herein, a software developer may generate deployment image120 and store the image in image source space 110, which isrepresentative of a repository for users to select and deploy requiredimages. Once stored and a user selects the image, a new virtualizedinstance or virtual machine is initiated to support the request. Here,multiple requests are generated for deployment image 120 and are used togenerate virtual machine 130 and virtual machine 330.

Referring first to virtual machine 130, registration operation 124 isexecuted upon initiation of the virtual machine to generate registrationinformation 132, wherein registration information 132 corresponds tounique attributes of the virtual machine. Once executed registrationoperation 124 may be removed from virtual machine 130. Turning to asecond request for deployment image 120, a second virtual machine 330 isinitiated and registration operation 124 generates registrationinformation 332 that corresponds to unique attributes of virtual machine330. For example, registration information 132 and 332 may include atleast a MAC address associated with the corresponding virtual machineand a virtual machine identifier associated with the correspondingvirtual machine. Once the registration information is stored in thevirtual machines and registration operation 124 is deleted from each ofthe virtual machines, software 122 may be permitted to execute on thevirtual machine. Software 122 may comprise a data processingapplication, a front end serving application, a database managementapplication or some other application. Although not illustrated inoperational scenario 300, each virtual machine may further include anoperating system and/or other support services or applications toprovide the desired functionality associated with software 122

In some implementations, when a virtual machine is first initiated fromdeployment image 120, one or more communication protocols may bedisabled for the virtual machine. Once the registration information isgenerated and stored, the one or more protocols may be enabled,permitting interactions with the virtual machine. These interactions maybe used to configure software 122, permit software 122 to communicatewith one or more other databases or applications or provide some otherfunctionality.

FIG. 4 illustrates an operational scenario 400 of managing licenses in avirtualized instance according to an implementation. Operationalscenario 400 includes first initiation 410 and second initiation 412.First initiation 410 includes virtual machine 430 with software 422,check operation 470, and registration information 432 with attributes442, 452, and 462. Second initiation 412 includes virtual machine 430,software 422, check operation 470, and registration information 432.

In operation, when a virtual machine is first initiated from an image, aprocess on the virtual machine may generate registration information432, wherein registration information 432 includes attributes to managelicensing for software 422. Software 422 may comprise a data processingapplication, a database application, or some other application. Onceregistration information 432 is generated for first initiation 410, theprocess that generated and stored registration information 432 isdeleted or removed from virtual machine 430. Registration information432 is then used to determine during subsequent initiations of virtualmachine 430 whether software 422 is available for execution on thevirtual machine.

Here, during second initiation 412, check operation 470 is used tocompare a current configuration 480 for virtual machine 430 withregistration information 432 to determine whether the currentconfiguration matches the stored information. Here, the currentconfiguration information matches registration information 432, whichindicates that software 422 is permitted to execute on virtual machine430. In some implementations, software 422 may be prevented fromexecution until check operation 470 is performed. Once the checkoperation is performed and the execution is permitted, software 422 maybe made available for execution on the computing system. In someimplementations, in preventing the execution of software 422, software422 may be encrypted and decrypted for execution based on checkoperation 470, may be blocked using registry keys, or may be blocked inany other similar manner. In some examples, when check operation 470determines that the current configuration information fails to matchregistration information 432, check operation 470 may remove or deletesoftware 422 from virtual machine 430.

In some implementations, when second initiation 412 occurs, checkoperation 470 may disable one or more communication protocols to virtualmachine 430. This may prevent an end user from interacting with virtualmachine 430 until check operation 470 is completed. Once check operation470 is completed and software 422 is permitted based on the comparisonof the current configuration information and registration information432, check operation 470 may reenable the one or more communicationprotocols. This will permit a user to interact with the availablesoftware and for the software to interact with any other requiredcomputing elements.

In some implementations, registration information 432 may be encryptedprior to storage in virtual machine 430. The encryption may beaccomplished using public and private encryption keys that can encryptthe registration information using the public key (that is deleted aspart of the first registration operation) and decrypted during the checkof the registration information. The encryption may also be accomplishedusing a hash function or some other encryption function. For example,when registration information 432 is first identified, the informationmay be passed through a hash function and stored on virtual machine 430.During each subsequent initiation of the virtual machine, the currentconfiguration information may be identified and passed through a hashfunction to determine if the hash values match.

FIG. 5 illustrates an operational scenario 500 of managing licenses in avirtualized instance according to an implementation. Operationalscenario 500 includes first initiation 510 and second initiation 512.First initiation 510 includes virtual machine 530 with software 522,check operation 570, and registration information 532 with attributes542, 552, and 562. Second initiation 512 includes virtual machine 530,software 522, check operation 570, and registration information 532.

In operation, when a virtual machine is first initiated from an image, aprocess on the virtual machine may generate registration information532, wherein registration information 532 includes attributes to managelicensing for software 522. Software 522 may comprise a data processingapplication, a database application, or some other application. Onceregistration information 532 is generated for first initiation 510, theprocess that generated and stored registration information 532 isdeleted or removed from virtual machine 530. Registration information532 is then used to determine, during subsequent initiations of virtualmachine 530, whether software 522 is available for execution on thevirtual machine.

Here, in a second initiation 512 for virtual machine 530, checkoperation 570 is used to determine whether a match exists between acurrent configuration 580 for the virtual machine and registrationinformation 532. In particular, check operation 570 may gather currentconfiguration attributes associated with the second initiation andcompare the attributes to attributes 542, 552, and 562 stored withrespect to registration information 532. When check operation 570determines that attribute 590 is different than attribute 562, checkoperation 570 may block the execution of software 522 from providing thedesired operation. To block the execution, check operation 570 ensurethat the executable portions of software 522 are encrypted, may modifyregistry keys or other attributes associated with the application, maydelete at least a portion of software 522 from virtual machine 530, ormay provide some other operation to prevent the execution of thesoftware. For example, if the second initiation of virtual machine 530occurred as a result of an image generated from virtual machine 530during first initiation, the virtual machine during the secondinitiation may be allocated a different virtual machine identifier, MACaddress, or some other attribute(s). Consequently, check operation 570may determine the differences in the attributes and prevent theexecution of the software (or the entire virtual machine in someexamples).

In some implementations, the registration operation and the checkoperation may both be used to limit user interactions with the virtualmachine during the licensing operations. In some implementations, eachtime that virtual machine 530 is initiated one or more communicationprotocols may be disabled to prevent user connections to the virtualmachine. Once disabled, the licensing operations may be used to generatethe registration information or compare the registration information tothe current configuration for the virtual machine. Once the registrationinformation is determined or the check operation indicates that thesoftware should be available for execution, the one or more protocolsmay be enabled, permitting a user to interact with the virtual machine.

FIG. 6 illustrates a computing system 600 to manage licenses for avirtualized instance according to an implementation. Computing system600 is representative of any computing system or systems with which thevarious operational architectures, processes, scenarios, and sequencesdisclosed herein for a host system can be implemented. Computing system600 includes storage system 645, processing system 650, andcommunication interface 660. Processing system 650 is operatively linkedto communication interface 660 and storage system 645. Communicationinterface 660 may be communicatively linked to storage system 645 insome implementations. Computing system 600 may further include othercomponents such as a battery and enclosure that are not shown forclarity.

Communication interface 660 comprises components that communicate overcommunication links, such as network cards, ports, radio frequency (RF),processing circuitry and software, or some other communication devices.Communication interface 660 may be configured to communicate overmetallic, wireless, or optical links. Communication interface 660 may beconfigured to use Time Division Multiplex (TDM), Internet Protocol (IP),Ethernet, optical networking, wireless protocols, communicationsignaling, or some other communication format—including combinationsthereof. Communication interface 660 may be configured to communicatewith one or more end user devices in some examples that permit a user tointeract with virtual machine 620. Additionally, communication interface660 may be used to communicate with one or more other computing systemsthat can provide resources to virtual machine 620, wherein the resourcesmay include other applications, databases, or some other resource.

Processing system 650 comprises microprocessor and other circuitry thatretrieves and executes operating software from storage system 645.Storage system 645 may include volatile and nonvolatile, removable andnon-removable media implemented in any method or technology for storageof information, such as computer readable instructions, data structures,program modules, or other data. Storage system 645 may be implemented asa single storage device but may also be implemented across multiplestorage devices or sub-systems. Storage system 645 may compriseadditional elements, such as a controller to read operating softwarefrom the storage systems. Examples of storage media include randomaccess memory, read only memory, magnetic disks, optical disks, andflash memory, as well as any combination or variation thereof, or anyother type of storage media. In some implementations, the storage mediamay be a non-transitory storage media. In some instances, at least aportion of the storage media may be transitory. It should be understoodthat in no case is the storage media a propagated signal.

Processing system 650 is typically mounted on a circuit board that mayalso hold the storage system. The operating software of storage system645 comprises computer programs, firmware, or some other form ofmachine-readable program instructions. The operating software of storagesystem 645 comprises virtual machine 620, wherein virtual machine 620further includes application 621, comparison operation 622, andregistration operation 623. The operating software on storage system 645may further include an operating system, utilities, drivers, networkinterfaces, applications, or some other type of software. When read andexecuted by processing system 650, the operating software on storagesystem 645 directs computing system 600 to operate as described herein.

In one implementation, virtual machine 620 may be initiated in responseto a request for an end user for an application image. The image mayinclude the operating system for the virtual machine, services,applications, or any other required element to provide a desiredoperation. Once selected, a host for the virtual machine can beidentified in either a public or provide computing environment, and thevirtual machine may be provided with resources to execute the virtualmachine.

Here, when virtual machine 620 is initiated, registration operation 623is executed to determine licensing information associated withapplication 621. In some implementations, registration operation 623directs processing system 650 to identify attributes associated withvirtual machine 620. These attributes may include a MAC addressassociated with virtual machine 620, a virtual machine identifier, ahost identifier, or any other attribute capable of identifying thevirtual machine. Once identified, registration operation 623 directsprocessing system 650 to store the registration information in virtualmachine 620, wherein the registration information may be stored asencrypted data in some examples. After storing the registrationinformation, registration operation 623 is removed or deleted fromvirtual machine 620 to prevent access to the operation during futureinitiations of the virtual machine.

Once the registration information is stored, the registrationinformation may be used by comparison operation 622 in futureinitiations of virtual machine 620 to determine whether application 620should be made available to the user of virtual machine 620. The secondinitiation may come as a result to a stoppage of virtual machine, apower down of the host, a migration of the virtual machine betweenhosts, or some other second initiation. In response to the secondinitiation, comparison operation 622 may direct processing system 650 todetermine current configuration associated with the virtual machine 620and determine whether the current configuration matches the storedregistration data from the first initiation. If a match exists,comparison operation 622 may direct processing system 650 to permit theexecution of application 620. However, if a match does not exist,comparison operation 622 may direct processing system 650 to block theexecution of application 620. In blocking the execution, comparisonoperation 622 may be used to prevent user access to the virtual machine,delete or encrypt the application, or provide some other operation toblock the execution of application 620.

As an example, a user associated with virtual machine 620 may generatean image of the virtual machine after it is deployed in a host. From theimage, the user may attempt to generate multiple instances to avoidpaying for multiple licenses. Here, when a duplicate is deployed,comparison operation 622 may identify differences between the currentconfiguration and the stored registration information and may block theexecution of the application. These differences may include a differentMAC addresses, different virtual machine identifiers, or some otherdifferent attribute.

In at least one example, operations 622-623 may be used to disable oneor more communication protocols with virtual machine 620. In disablingthe communication protocols, the operations may identify when thevirtual machine is initiated and prevent incoming and outgoingcommunications to prevent a user from interacting with the virtualmachine until the licensing operations are completed. In the example ofregistration operation 623, communications with the virtual machine maybe prohibited until the registration information is stored on virtualmachine 620. Similarly, once stored and during a subsequent initiation,communications may be prohibited until the current configurationinformation is compared to the previously stored registrationinformation. Once the licensing operations are completed, thecommunication protocols may be enabled permitting a user to interactwith the virtual machine or permitting the application to communicatewith external resources. These resources may include other applications,databases, or some other resource.

Although demonstrated with a single application in the example ofcomputing system 600, it should be understood that multiple applicationsmay be available on a single image. The applications may share commonregistration information or may determine and store unique registrationinformation.

The included descriptions and figures depict specific implementations toteach those skilled in the art how to make and use the best option. Forthe purpose of teaching inventive principles, some conventional aspectshave been simplified or omitted. Those skilled in the art willappreciate variations from these implementations that fall within thescope of the invention. Those skilled in the art will also appreciatethat the features described above can be combined in various ways toform multiple implementations. As a result, the invention is not limitedto the specific implementations described above, but only by the claimsand their equivalents.

What is claimed is:
 1. A method comprising: identifying a request for afirst initiation of a virtualized instance from an image; in response tothe request and the first initiation, initiating a process in thevirtualized instance to determine registration information associatedwith the virtualized instance; preventing ingress and/or egresscommunications for one or more communication formats prior to initiatingthe process to determine the registration information; storing theregistration information in the virtualized instance; in response tostoring the registration information, deleting the process thatdetermined the registration information; in response to deleting theprocess that determined the registration information, enabling theingress and/or egress communications for the one or more communicationformats; in response to a subsequent initiation of the virtualizedinstance after the first initiation, comparing current configurationinformation associated with the subsequent initiation with theregistration information stored in the virtualized instance to determinewhether the subsequent initiation is permitted; and in response todetermining that the subsequent initiation is permitted, making anapplication associated with the image available to a user of thevirtualized instance.
 2. The method of claim 1 further comprising, inresponse to determining that the subsequent initiation is not permitted,blocking an execution of the application associated with the image. 3.The method of claim 1, wherein comparing the current configurationinformation associated with the subsequent initiation with theregistration information stored in the virtualized instance to determinewhether the subsequent initiation is permitted comprises: determiningwhether a match exists between the current configuration information andthe registration information; determining that the subsequent initiationis permitted when the match exists.
 4. The method of claim 1, whereinthe virtualized instance comprises a virtual machine.
 5. The method ofclaim 1, wherein the registration information comprises a media accesscontrol (MAC) address and/or a virtual machine identifier.
 6. The methodof claim 1, wherein the current configuration information comprises amedia access control (MAC) address and/or virtual machine identifier. 7.The method of claim 1 further comprising: encrypting the registrationinformation associated with the virtualized instance; wherein storingthe registration information in the virtualized instance comprisesstoring the encrypted registration information.
 8. A computing systemcomprising: a storage system; a processing system operatively coupled tothe storage system; and program instructions stored on the storagesystem that, when executed by the processing system, direct theprocessing system to: identify a request for a first initiation of avirtualized instance from an image; in response to the request and thefirst initiation, initiating a process in the virtualized instance todetermine registration information associated with the virtualizedinstance; prevent ingress and/or egress communications for one or morecommunication formats prior to initiating the process to determine theregistration information; store the registration information in thevirtualized instance; in response to storing the registrationinformation, delete the process that determined the registrationinformation; in response to deleting the process that determined theregistration information, enable the ingress and/or egresscommunications for the one or more communication formats; in response toa subsequent initiation of the virtualized instance after the firstinitiation, compare current configuration information associated withthe subsequent initiation with the registration information stored inthe virtualized instance to determine whether the subsequent initiationis permitted; and in response to determining that the subsequentinitiation is permitted, make an application associated with the imageavailable to a user of the virtualized instance.
 9. The computing systemof claim 8, wherein the program instructions further direct theprocessing system to, in response to determining that the subsequentinitiation is not permitted, block an execution of the applicationassociated with the image.
 10. The computing system of claim 8, whereincomparing the current configuration information associated with thesubsequent initiation with the registration information stored in thevirtualized instance to determine whether the subsequent initiation ispermitted comprises: determining whether a match exists between thecurrent configuration information and the registration information;determining that the subsequent initiation is permitted when the matchexists.
 11. The computing system of claim 8, wherein the virtualizedinstance comprises a virtual machine.
 12. The computing system of claim8, wherein the registration information comprises a media access control(MAC) address and/or a virtual machine identifier.
 13. The computingsystem of claim 8, wherein the current configuration informationcomprises a media access control (MAC) address and/or virtual machineidentifier.
 14. The computing system of claim 8, wherein the programinstructions further direct the processing system to: encrypt theregistration information associated with the virtualized instance;wherein storing the registration information in the virtualized instancecomprises storing the encrypted registration information.
 15. One ormore non-transitory computer readable storage media having programinstructions stored thereon that, when executed by a processing system,direct the processing system to: identify a request for a firstinitiation of a virtualized instance from an image; in response to therequest and the first initiation, initiating a process in thevirtualized instance to determine registration information associatedwith the virtualized instance; prevent ingress and/or egresscommunications for one or more communication formats prior to initiatingthe process to determine the registration information; store theregistration information in the virtualized instance; in response tostoring the registration information, delete the process that determinedthe registration information; in response to deleting the process thatdetermined the registration information, enable the ingress and/oregress communications for the one or more communication formats; inresponse to a subsequent initiation of the virtualized instance afterthe first initiation, compare current configuration informationassociated with the subsequent initiation with the registrationinformation stored in the virtualized instance to determine whether thesubsequent initiation is permitted; and in response to determining thatthe subsequent initiation is permitted, make an application associatedwith the image available to a user of the virtualized instance.